Heh...I was one that you were flaming...and looky here, we're agreeing about this topic!KoolDrew said:Yup. I learned that in a past argument when I was wrong about some points. It ended up with me being an idiot flaming other members. I was young and a bit stubborn at age 15. Now I am 16
![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
services.msc
- Thread starter mdlsFREAK
- Start date
- Status
Which had also been patched, wonder of wonders.rcolbert said:
Actually, the original post and my previous comments indicated specifying client operating systems, hence my earlier "shifting goalposts" comments.
Wait, you mean the service that is now off by default? You should really try harder. Now you're building men of straw to argue against.
And are not supported as a means of improving performance or increasing security. Patching holes and using supported performance improvement measures are the way to go
Not when used properly under a sufficiently safe setup (firewall, patched modules, etc.).
If by "infinitesimally small" you mean "cannot be measured in performance at all," then we have already been saying the same thing.
Nice to see you finally admit that.
GreNME said:
Quite contrary to the first statement. Refer again the the official document on securing Windows XP.
As to the second, what disabling particular services does is protect you from exploits that are not yet patched. Sometimes it literally takes months for vulnerabilities to be patched from the time they are discovered. Patching is one of many steps required to maintain a secure system.
If you've ever been to any of the Microsoft Security Conferences you'd realize that THEY TEACH THIS SHIT. I'm not making this up for my own amusement. Again, what part of "Therefore, any unneeded services or executable files should be disabled or removed in your environment" is unclear to you?
GreNME said:
And if by saying that you mean that everything has been patched now and that no existing services will have vulnerabilities that require patching, then I'd say you might have a point. But in countering the principle that it's a good idea to reduce the surface area against future and unknown vulnerabilities by indicating that past examples of vulnerabilities have been patched is pure stupidity.
GreNME said:
Are you saying that by applying Service Pack 2 to Windows XP that it will disable the previously enabled Messenger service? Or are you saying that there is a newly slipstreamed version that all the [H] members are using to build their systems?
GreNME said:
I have been arguing ad nauseum that I am not talking about perceptible performance issues except in specific and rare cases. What I am saying is that computer behavior has been described inaccurately in such a way that would give people who do not know much about them the mistaken impression that computers fundamentally behave differently than they actually do. And by "at all" you must mean "at all by you." In truth if you knew anything about measuring CPU performance you'd know that CPU performance data can't even be directly measured, only inferred. I'm sorry, but you look at counters but have no idea where the numbers really come from. So sad.
KoolDrew said:
How about doing your chores or your homework instead of telling me how to post?
I don't happen to like the dissection method of posting and I do like to take my time and respond to each point as I see fit. I'd rather focus on the content of my statements than worry about cutting and pasting and moving tags around simply for the convenience of someone who clearly has plenty of time on his hands to read my responses regardless of the surrounding formatting.
If you don't like it, scroll on by..
ok...rcolbert said:
there is so much wrong in what you just wrote...
First of all,
Who the f**k do you think you are?
So he's 16, you might be 9 for all I care.
The ability to use quote tags (and all the other tags for that matter...) many times in the same post was created so that you didnt have to make SIX FREAKING POSTS IN A ROW....
I didnt noticed there was a timer on your "Replay to Thread" dialog, you can take as many time you want... (unless the system logs you out, i dont think it does though...)
BTW, nice way to boost your post count...
chinoquezada said:ok...
there is so much wrong in what you just wrote...
First of all,
Who the f**k do you think you are?
So he's 16, you might be 9 for all I care.
The ability to use quote tags (and all the other tags for that matter...) many times in the same post was created so that you didnt have to make SIX FREAKING POSTS IN A ROW....
I didnt noticed there was a timer on your "Replay to Thread" dialog, you can take as many time you want... (unless the system logs you out, i dont think it does though...)
BTW, nice way to boost your post count...
Why don't you both try and stay on topic. I don't need a fucking ettiquite lesson from the peanut gallery. And like I give a shit about my post count.
SJConsultant
2[H]4U
- Joined
- Jan 14, 2004
- Messages
- 3,599
rcolbert said:
Having a firewall on said system is also a way to maintain secure systems as well. Remember Blaster?
Merely using TCP/IP filtering to only allow incoming connections on port 25 for a mail relay server negates the need to disable services since a hacker can only connect via port 25 correct? (XP or 2000 Professional can be used as a mail relay server.)
rcolbert said:
Generally speaking if a machine doesn't use IIS, then remove it (which is an optional component on XP Pro), same thing for SNMP service. Removing executables is not a good idea on client machines from a troubleshooting perspective since you may need some of those to figure out a problem, setting NTFS permissions is a better option. While in some corporate environments you can reimage a machine quicker than troubleshooting, it still doesn't solve the original problem if you don't know what caused it in the first place.
rcolbert said:
If SP2 is applied to an existing install of XP or by using a slipstreamed version then yes messenger service is disabled.
However, if people were using a firewall then outsiders couldn't connect to their system.
Now while GreNME knows my position on disabling services, there is a time and a place to do it. Quite frankly client systems have very few you can "safely" disable without having some kind of problem develop later on. This all needs to be taken in perspective of an overall plan for security, by no means is disabling services the only method to secure against attacks.
You guys can argue about disabling services all day long as it applies to security, but in the end, it is not a matter of right or wrong. Security has to be applied in a fashion that suits the need and the risk assesment of the environment.
You agree that blanket statements are bad, but you just threw a very large one...rcolbert said:
Just who is the intended audience at those conferences? Home/Gamer PC owners? No, the same "high security" folks. Again I'll post it, read it carefully. In the VERY same document from MS where they recommend disabling security for high security environments they define this environment as:
"High Security
The high security environment consists of elevated security settings for the client. When
applying high security settings, user functionality is limited to specific functions that are
only required for the necessary tasks. Access is limited to approved applications,
services, and infrastructure environments."
That does NOT describe the audience of this board, nor the casual "how should I tweak my system?" requests. If we were discussing DoD security, it would be more appropriate to disable ALL unused services. See the difference? MS does.
You can't take everything MS says as gospel and apply it to every situation.
edit:
QFTSJConsultant said:
rcolbert, I'm not saying this to be a flame, but more of a warning. Your doing nothing but flaming other people. I've followed some of your conversations in other threads, and you seem to do exactly what you accuse others of doing, whether it be flaming, name-dropping, or just flat out insulting. You've single-handedly, over the course of several threads, started arguments with some of the most senior and trusted members on here. Your not going to build any type of respect, nor will you enjoy any type of longevity here, because the mods will surely boot you out. One can tell your not an idiot, so add to the forums, don't subtract from them. There's no shame in admitting your wrong from time to time....it doesn't make your e-wang any smaller.
Funny, they say lots of things.rcolbert said:
1. You assume I've never been.
2. You assume dropping names once again gives you more credibility (it does not).
3. You are using a rather vague and absolute "they."
4. Just because you are frustrated and devolving into all caps and swearing it does not make you more right.
5. I commend you on the creativity to say the same thing a bunch of different ways, but you are still arguing semantical nonsense and shifting goalposts.
For someone who has such a hard-on for dropping names to try to sound like they are smarter than anyone who disagrees, the fact that you were unaware that applying the service pack sets that service to a disabled state really makes you look like you know a whole lot less than you claim. That's a pretty simple and basic thing to know, especially from someone claiming to be as familiar with the OS as you claim, and you didn't even realize that.
Man, your credibility is dropping fast.
Me too. Funny that.
You mean sad like how you didn't even know about how applying a service pack will affect the startup state of services? Like how you have asserted that pre-emptive multitasking has nothing to do with it, but has everything to do with keeping resources where they are being used and away from where they are not? Like how at least one person who has a whole lot more in-depth access to the kernel than you ever will has basically stated the same thing I did in this very thread, and yet you persist?
So sad, indeed.
For someone bragging about the greater understanding of programming and software properties, you seem to have a surprisingly weak ability to handle a few simple scripted tags. Man, your credibility is dropping by the post. If you don't even feel like taking the time to make your statements presentable in a format that is both more acceptable and readable simply from a threaded discussion standpoint, why the hell should we even take the time to read your posts? What you are doing is a quick way to get yourself ignored, and if you continue to be a snippy bitch about it, banned.
Badger_sly
[H]ard|Gawd
- Joined
- Mar 20, 2002
- Messages
- 1,594
Sadly that's true concerning some of them.O[H]-Zone said:
It wasn't rcolbert that he was referring to.djnes said:
Nice to see you're finally admitting that you do that.O[H]-Zone said:
I pointed out the "Security Myths" link, official from Microsoft. Doing anything for the sake of tweaking is not a supported nor a recommended method. Period. And no instance having to do with Windows XP has been shown to be valid. Since still nothing has been shown to be valid and colbert persists in attacking my character and more name-dropping, all I can do is point out that he is still blowing wind, dropping names, and not really adding valid points to his argument. O[H]-Zone is adding to the trolling by further flaming.
Good going, guys. You just make me look better than I actually am.
djnes said:
I simply question some of those "well trusted" folks who can't ever concede a point. I also tend to respond in kind so when I get a shitty comment, I give one back. I do appreciate those who have engaged in the discussion with information and reasoning. I don't appreciate those folks who just got out of a freshman critical thinking class and decided to use all the terminology they just learned to debate the quality of the arguments on the other side by attacking the logical structure of any given phrase or post without actually addressing the quality or point of the information. Bottom line is that anyone who needs to use Latin to tell me why my point is invalid is a total asshat.
Your only argument standing is security. First, I have disolved that argument by putting it in the correct POV, "high security", aka DoD type environment. Second, MS further clarifies that position with the doc GreNME posted.rcolbert said:
QED.
P.S. Your bordering of flamming.
P.P.S. Latin > you.
Uhhh...no, that was you I was referring to. Anybody who says, in effect, that recommendations from Microsoft don't apply here, because that's for a REALLY REALLY secure environment, and we're just after a REALLY secure environment has obviously lost the argument...if you feel like you're about to post something really inane, please try and stop yourself. Bottom line here: if someone comes on here and says he knows more about securing an M$ operating system than M$ does, he's blowing wind.GreNME said:
It's MS' definition of the envorinment, bitch at them. When I can show someone how they are wrong, with information from the VERY same document, I think that demonstrates quite a bit. However, that finer point is lost on you.O[H]-Zone said:
Again, are you in a "high security" environment? Is anyone on this board? Even if they are, I'd bet they would qualify such questions about tweaking that they are in such an envoironment, at least they should.
Do you realize if you follow the "high security" recommendations you need to disable USB? Are you suggesting we do that too? Will you even answer these questions?
Gee, except I'm 30 years old and apply my critical thinking skills every day, not just to get a grade when I was a kid. You'll also notice I don't just drop names, even though I've done plenty enough security work to know of what I talk about. Just because you are twisting what I say out of context to try to support your claims that have already been deconstructed and then get snippy about it does not make you right. Just because you drop names out the wazoo does not make you right. Just because you flame when your logic is pointed out as flawed does not make you right.rcolbert said:
SJConsultant said it best when it comes to applying the right security measure to the situation and usage at hand. If you aren't using something, don't install it to begin with. For things that are usedand the default XP services are usedthere are already countermeasures that work, and you've done jack and shit to prove otherwise.
Nice "I know you are but what am I?" you did there.O[H]-Zone said:
Reading puts the "fun" in "fundemental."
You should learn to follow your own advice.
And yet that's exactly what rcolbert has done.
Since you're obviously not a blindingly stupid person, you already must realize that the point from the beginning was to improve security on any given machine. Again, since you're not a complete idiot, you also realize that nobody could make a guide to security for every different situation a computer might be placed in. So, being a non-moron, you undoubtedly realize that we as users must research the security we use. We must look at many different sources, and decide what's right for us. But of course, you're not stupid...you already knew that. So when M$ produces a guide, we can look at it as a grouping of practices that will give the highest security. Do we need to act on every suggestion? Of course not; you're not idiotic enough to suggest that.Phoenix86 said:Do you realize if you follow the "high security" recommendations you need to disable USB? Are you suggesting we do that too? Will you even answer these questions?
So why do you ask such a question?
My Premise: The principle of stopping unneeded services has some merit and should not be summarily dismissed.
My Evidence: Microsoft's own security recommendations
The Rebuttal: Doesn't apply because it's for "high security" systems
My Response: That doesn't invalidate the principle and by the way, it also applies to Enterprise and Standalone systems so stop taking my evidence and subjecting it to an overly narrow interpretation.
That in a nutshell is my argument with Phoenix, who I respect but disagree with.
My Premise: Security is a multi-faceted issue and that services due to the fact that they are running processes need to be considered as to whether or not they are necesarry.
My Evidence: Microsoft's own security reccomendations
The Rebuttal: Patching is the way to go. Firewalls are the way to go. Nothing can be exploited if it's properly patched and your firewall is running. NAT makes everything OK.
My Response: Patching only prevents exploiting known vulnerabilities. Firewalls and NAT are good, but the end result is known as "crunchy on the outside, chewy on the inside." In fact, while doing the above is most certainly recommended and provides a great deal of protection, the simple fact is that protecting the network vector and patching for known exploits is not always enough. Some folks here have expressed that in essence the combination of network security and patching is a 100% failsafe solution. I argue that there have been countless exploits in the past that have either come through ports that must be open in order for a device to perform its required functions, and also that many exploits happen based on activities of the client, and while the network is a transport involved, there is no degree of firewalling or NATting that will prevent you from browsing to the wrong site and downloading malicious content if your ISP's DNS server cache has been compromised. Other means are required. Services are a small part of the rest of the big picture.
That is my argument with GreNME who makes a whole lot of points about security that I disagree with.
My Evidence: Microsoft's own security recommendations
The Rebuttal: Doesn't apply because it's for "high security" systems
My Response: That doesn't invalidate the principle and by the way, it also applies to Enterprise and Standalone systems so stop taking my evidence and subjecting it to an overly narrow interpretation.
That in a nutshell is my argument with Phoenix, who I respect but disagree with.
My Premise: Security is a multi-faceted issue and that services due to the fact that they are running processes need to be considered as to whether or not they are necesarry.
My Evidence: Microsoft's own security reccomendations
The Rebuttal: Patching is the way to go. Firewalls are the way to go. Nothing can be exploited if it's properly patched and your firewall is running. NAT makes everything OK.
My Response: Patching only prevents exploiting known vulnerabilities. Firewalls and NAT are good, but the end result is known as "crunchy on the outside, chewy on the inside." In fact, while doing the above is most certainly recommended and provides a great deal of protection, the simple fact is that protecting the network vector and patching for known exploits is not always enough. Some folks here have expressed that in essence the combination of network security and patching is a 100% failsafe solution. I argue that there have been countless exploits in the past that have either come through ports that must be open in order for a device to perform its required functions, and also that many exploits happen based on activities of the client, and while the network is a transport involved, there is no degree of firewalling or NATting that will prevent you from browsing to the wrong site and downloading malicious content if your ISP's DNS server cache has been compromised. Other means are required. Services are a small part of the rest of the big picture.
That is my argument with GreNME who makes a whole lot of points about security that I disagree with.
It's so easy for you to argue when you build a man of straw.
________
I say that there are no default XP services that need to be disabled.
You bring up services that are already set as disabled.
You bring up services that are not present in XP.
You drop names and try to use that as your credibility, on an internet forum, no less.
I point out that not only are the services either disabled or not present on XP, but that they are patched.
You throw a hissy fit and call me a child.
You make a link to Microsoft.
I state once again that you have yet to validate your point with real examples.
I show a link to Microsoft.
You do more of your insipid flaming.
________
See? It works both ways.
________
I say that there are no default XP services that need to be disabled.
You bring up services that are already set as disabled.
You bring up services that are not present in XP.
You drop names and try to use that as your credibility, on an internet forum, no less.
I point out that not only are the services either disabled or not present on XP, but that they are patched.
You throw a hissy fit and call me a child.
You make a link to Microsoft.
I state once again that you have yet to validate your point with real examples.
I show a link to Microsoft.
You do more of your insipid flaming.
________
See? It works both ways.
O[H]-Zone said:
Because those questions are relevant and necessary to make you realize the bolded statement.
You don't need to disable services because that doesn't apply to MANY situations. Yet your arguing that point in a forum where the average, if not vast majority of users are home users. The documents about disabling services for sercurity aren't even for corporate use, much less home.
odoe
[H]F Junkie
- Joined
- Oct 10, 2001
- Messages
- 9,796
This whole thread needs to chil out.
You guys know the rules, keep personal attacks out of it. If you want to attack the arguments, go on ahead, but do not, and I feel stupid for having to repeat this to people who have been on this board for 2 years or more and I seem to repeat it all the time in this particular forum, DO NOT resort to personal attacks.
You guys know the rules, keep personal attacks out of it. If you want to attack the arguments, go on ahead, but do not, and I feel stupid for having to repeat this to people who have been on this board for 2 years or more and I seem to repeat it all the time in this particular forum, DO NOT resort to personal attacks.
Good we have agreed that people in high security environments need services disabled. People in home/stardard corporate don't. That's not a narrow interpretation, it's what the document says.rcolbert said:
Extend that knowledge to the argument here (how do we tweak services, sic home PCs), and you'll see your making moot arguments. Your arguments are precise, but not accuate and thus irrelevant.
GreNME said:
If you in fact were applying your critical thinking skills, you would realize that if I were to make a fallacious statement, then you must strategically counter with a clever statement that reveals the flaw in my thinking. You can't simply start jumping up and down shouting "post hoc ergo propter hoc, ad hominem, ad hominem" and expect your ability to identify logical fallacies to carry the day. If my logic based on the premise that "If A then B" turns out to be "B and therefore A" I might have a reasoning issue, but at the same time I might be right even despite the flaw in my logic. In my experience it's best to keep the argument on-topic. Can you imagine someone on the Harvard debate team responding to the opponent with "Red Herring you fool! I Win!"
And please point out name dropping that I've done that actually includes "names." I have tried to establish evidence in terms of referencing direct contact with authoritative sources, and you in turn reply "name dropping" or "appeal to authority" and therefore I have since terminated that process and turned instead solely to Microsoft's own published documentation. Now, when I reference publicly available information such as that presented at a Microsoft Security Conference, it is somehow valid for folks to take that conference that they did not attend and have no knowledge of and try and dismiss the information obtained as "only intended for a high security environment." That is completely untrue however, as the conference was geared directly at regular corporate and enterprise customers. How is it that I cannot come into this forum and say "Hey, this is information that Microsoft just provided in a Security Conference" and not have everyonewho disagrees with the premise that it supports attack either the content or the context of the information? Do you believe that I attended the Conference and was unaware of the context? And as a note, this Conference is not the seminal event in my premise. I simply intended to use the publicly available, albeit difficult to directly reference material as additional evidence supporting the idea that services that are not required should be disabled if research demonstrates that doing so has no adverse impact to the system.
I am not, nor have I ever asked anyone to agree with me. All I have ever stated was that the "don't touch your services" camp was overstating their position with absolutes and sweeping statments, and needed to inject a small portion of moderation or conditionality. I take the ever-reducing scope of this argument which has been reduced to "users of this forum who are running Windows XP with SP2 at home and have a fully patched, NATted and Firewall/AV/Spyware protected system" to be the unspoken concession that I sought.
rcolbert said:
I can only respond to evidence I can validate. Now you want us to expand what MS is saying to other cases "because they said so at the conference". Excuse me while I laugh for a bit...
...
...
OK, now I re-read your "Red Herring you fool! I Win!" statement...
...
... (still laughing)
and I'm thinking...
...
...
"You weren't at the conference fool! I win!"
I think many of us agree with that document, your the one that doesn't seem to. Just so you're aware, it's *your* application of the information in that document I disagree with, not the document itself.
Phoenix86 said:
I am starting to realize that I am the only side of this argument providing any evidence outside of opinion. I also notice that you are accepting certain portions of the evidence presented, and rejecting others. I don't recall the logic you use that draws a technical disctinction between two different computers that run Windows XP Pro and happen to be installed in different environments. In my opinion a compromised system is a compromised system. A security breach isn't a slow leak. It's a binary event. It happened or it didn't. I also suggest that security attacks are directed at home users much more frequently than corporate users due to various and fairly obvious reasons.
I also don't recall the information you are presenting that distinctly prohibits adopting enterprise or corporate security practices in the home as a means of providing additional security. I would suggest that home users are not often encouraged to take the same steps as corporate IT simply due to the complexity factor and the depth of knowledge and experience required.
In other words, you have a point of view and that's about it. I don't see how my point of view differing from yours makes my arguments moot, inaccurate, or irrelevant.
Phoenix86 said:
In the context of what I was saying, I believe I was simply pointing out that for some unbeknownst reason I am not able to bring in references to direct experiences to supplement my point of view without exactly the reaction you just provided.
Would you care to present evidence that passes your own test to the effect that disabling unneeded services on a home installed Windows XP computer does NOT reduce the surface area of potential attack?
One thing is apparant here, and that is that I am having two different arguments with two different people in the same thread. I'll just note that I have different opinions about the two individuals and by no means are comments that I direct at one intended to also be directed at the other. Therefore, when it comes to personalities, semantics, rules of engagement and all this other off-topic stuff that we've ended up talking about, please take a moment and try and filter out responses that were neither directed at you personally, nor the point of view you are supporting.
No, what I will submit is that all steps mentioned in the doc are not for home users. That level of security isn't necessary for a number of reasons. There is a reason for differing setups for different environment. MS realizes this, and creates documentation for various environments, yet again, you don't understand or appreciate this distinction.rcolbert said:
So your position is pure security. You see a setting that = increased security and you use it. Fine. I'll ask you about USB. Do you also recommend we disable USB due to security? That's also mentioned in MANY security documents because of jump drives and USB routers.
Also, you have yet to name a service based exploit that affects the target audience, XP users at home (topic is for XP, I'm not being a moving target, though I was unaware of the license logging exploit).
Phoenix86 said:
You mean in the Myth 4 sections where they said:
"The rest of the protection for those systems was based on proper network segmentation, a solid understanding of the threats, turning off unneeded services, hardening Web apps (see Writing Secure Code, 2nd edition, by Howard and LeBlanc [Redmond, WA: Microsoft Press, 2003]), and properly protecting Web servers and the computer running SQL Server. Of course, this was a specialized system with very limited functionality, but it still shows that less is often more."
I think be both can read this statement and see positions that support either side of the argument. I know what you're saying is that higher security is a special case. What I am saying is that the practice of examining services to determine if they are necesarry is an accepted security princicple. We both agree that sweeping statements are to be avoided, yet we can't agree on whether the one-size-fits-all configuration of XP services out of the box is just that, a generalization. We agree that Microsoft has done more and more disabling of services themselves iteratively as time has gone by. That fact alone in my opinion supports my premise that the Microsoft approach is to reduce the amount of vulnerable surface area. What we don't agree on is whether or not they've finished the job in a way that satifies everyone. I will be the first to admit that I never intended to argue this matter within the very tight confines of a very specific target audience. I'm looking at the technology and the broad theoretical whereas you are looking at providing some very specific advice or counter-advice (counter to the Black Viper approach.) And truly at the genesis of this all, I simply dislike black and white statements and at the same time realize that when providing advice to less experienced folks (as in you providing your advice to folks asking questions on this forum), that they are sometimes necessary.
Phoenix86 said:
Acutally, in post #154 I made a clear reference to this distinction and explained why I thought advice varies. In short, there isn't a technical difference in many cases, nor is there a different set of threats applicable. The advice in my opinion is targeted to different levels of users, and that alone is probably the crux of our difference of opinion.
Phoenix86 said:
Disabling USB only makes sense in the case where physical access to a device and the ability to copy data from the device once physical access is obtained is of great concern. Clearly this doesn't apply to most home users. I suppose if you really have a trust issue within your household then USB settings on your PC are the least of your concerns. However, as you are well aware, the USB advice is heavily weighted in the environmental side rather than the technical side of security. In other words, the advice to disable USB is much more akin to the advice to not write your password on a sticky note and place it on your monitor.
The thought that I see a setting and choose to use it based on the criteria you provide is overly-simplistic and in no way reflects my real-world decision making process, but you knew that already. I suppose it was nicer than saying "monkey see, monkey do" but not by much.
I will admit freely that I was unaware that XP SP2 disabled the messenger service. Why? Because all my systems have had the messenger service disabled since XP was RTM. I didn't notice the change because on my systems it didn't change. Should I feel ignorant or validated? Possibly both. I have yet to validate the assertions about the messenger service but I take it on faith at this point. Can I prove at this moment in time that in some future release Microsoft will or won't disable additional services? No. Do we all agree that the current XP services configuration is closer to what it ought to be? Yes. Given that not all users are on SP2 now can I at least get a concession on the messenger service alone? I doubt it.
This is absolutely ridiculous, and why I originally wanted to opt out of the argument to begin with. It has become, for rcolbert, not a matter of getting to the heart of the issue, but of being able to say to others, myself included, "See? I'm right and you're wrong!"
This whole debate so far in the thread has been absolutely useless. No real discussion is going on, because I have only stated a very brief and not in-depth breakdown of my views on the matter. Yes, I said to avoid Quackviper, and I stand by it: he offers no real explanation on the services he claims should be disabled, and that's more than a little fucking dangerous. He makes those of us out there who really like to tweak and "hack" the innards of our software roll our eyes at his absolute statements and utter ignorance. So yes, when one points out his site as a "guide" I point out he hasn't a clue of what he speaks.
The long and short of it is that Windows XP services at their defaults are optimal for performance and security. If you want to mess around and disable things for their own sake and your piece-of-mind, you go right aheadit's your license and I really couldn't care less if you hose your machine.
There are services that are in a server environment on a server OS that one can examine and decide whether it should be on or not. If it shouldn't, then nine times out of ten it is able to be uninstalled and it shouldn't even be on the target machine to begin with. That is the basic precept in security that should be followed, not installing the whole mess and then disabling things at will. If something is on your machine and it is being used, then it should be patched and should have all of the proper countermeasures in place to keep it from being compromised. If someone is running SBS as a workstation OS and is worried about disabling services to squeak more performance or security from it, they need to be slapped in the head for running SBS as a workstation to begin withit has far too many components to be futzing with trying to shut off to work as a workstation. The same on a smaller scale applies to the vanilla server OS installs. That is why they are server operating systems and not client operating systems. It's all about the right tool for the right job, and not having a bunch of unnecessary tools on the system if you aren't using them.
Now rcolbert, you mentioned using the memsnap tool as some type of proof, but when challenged to explain an inconsistency you refused to do so. The thing is, I know exactly why memsnap showed the numbers it did for the example I asked you to describe (lsass), and that explanation goes further to describe what I mean by saying it uses no active resources. The memsnap tool is taking a poll of not just the service itself (which was paged even in your examople), but is also polling the shared files (almost unfailingly shared DLL files) that are not just being used by that process, but when it was first accessed by that process at startup it was associated with it under memsnap, despite it being tied to more than one running process. Remove the service it was associated with according to memsnap, and it is a pretty good guarantee that the shared libraries that numerous system services access will still grab it and consequently be associated with it by memsnap. Regardless, the original service (in this case, lsass) would still be completely paged and not polling the CPU or taking active memory space at all. Even the address location for it stored by the kernel would be paged if it has not been nor is directly being accessed (things like that are the parts of the kernel that get paged to begin with). That is how the kernel works. If you have an explanation of the processes by which memsnap is compiling the numbers that contradicts what I said, feel free to offer it up.
Once again, there is little or no reason to turn off any default Windows XP system service that is not already turned off. During installation, the services are set in a configuration that is most generally optimized for both startup and performance. This is not just an official Microsoft stance on it, this is testable and repeatable configuration that anyone themselves can try out. There are components that can be uninstalled or not installed to begin with, and if you (general you) are not going to use them then they shouldn't be there. Disabling is not the answer, and the question a person should ask themselves is "why is it installed to begin with?" For services like Wireless Zero Conf there are conditions where a manual setting isn't going to be a problem, but considering its innocuous and unobtrusive nature to begin with there are no performance issues and if no wireless device is connected the security issue is moot. If you're running IIS on a server, it's best to ask yourself why you're running it to begin with and remove it if it's not being used, not disabling the service itself.
This is why I take exception to your claims and have pretty much disregarded you as bullshitting: not because you're a total idiotyou seem to know enough to get by decentlybut because your very premise is flawed in that you are treating the symptoms instead of the cause. The number one reason Linux or BSD is hailed as being so great at security is because those who used it "back in the day" (more than five years ago) were already indoctrinated with the "if it ain't in use, why have it installed?" mentality. The same applies no matter what operating system you're running, which is why using the right tool for the job is more important than knowing how and where to run around shutting everything off. If you know what is installed and why, then the chances are that you will only have installed what you need to do the job anyway. This is the very reason why I suggest to those who want to game and don't just want to do it on a console to get XP Home Editionit already has less modules in it that you would otherwise have to go back and shut things off or uninstall things. This is why I would suggest Media Center Edition to someone who wants to use their PC for a video or audio center and don't just want an embedded receiver. This is why I suggest XP Pro for a domain workstation instead of Server 2003. It's all about using the right tool for the right job, and not trying to Swiss-Army-knife a solution from a single source. If you want to do that, then go ahead and download a *nix distro, re-work the kernel, and compile until your heart's content.
This isn't about me trying to pull some "gotcha!" or trying to press you to admit that you're wrong and I'm right. If your approach works for you then goody-good for you. Don't sell it as gospel, however: there are people who post here who actually work at Microsoft, know Microsoft's policies, and at least one of them has disagreed with you in this very thread. While I may not agree with everything Microsoft does as a software company, they have gotten the "right tool for the right job" mentality down pretty well now, and the options for how to improve system performance, security, and user experience are there. For every possible vulnerability, there are proper steps available to take. For 9.99 times out of ten, this has nothing to do with disabling services (even more if just talking about the client OSes).
Pointing out exceptions to the rule is not only simply point out the exceptions, but is trying to use that exception as if it were a loophole from which to apply poor practice as a common countermeasure for security.
This whole debate so far in the thread has been absolutely useless. No real discussion is going on, because I have only stated a very brief and not in-depth breakdown of my views on the matter. Yes, I said to avoid Quackviper, and I stand by it: he offers no real explanation on the services he claims should be disabled, and that's more than a little fucking dangerous. He makes those of us out there who really like to tweak and "hack" the innards of our software roll our eyes at his absolute statements and utter ignorance. So yes, when one points out his site as a "guide" I point out he hasn't a clue of what he speaks.
The long and short of it is that Windows XP services at their defaults are optimal for performance and security. If you want to mess around and disable things for their own sake and your piece-of-mind, you go right aheadit's your license and I really couldn't care less if you hose your machine.
There are services that are in a server environment on a server OS that one can examine and decide whether it should be on or not. If it shouldn't, then nine times out of ten it is able to be uninstalled and it shouldn't even be on the target machine to begin with. That is the basic precept in security that should be followed, not installing the whole mess and then disabling things at will. If something is on your machine and it is being used, then it should be patched and should have all of the proper countermeasures in place to keep it from being compromised. If someone is running SBS as a workstation OS and is worried about disabling services to squeak more performance or security from it, they need to be slapped in the head for running SBS as a workstation to begin withit has far too many components to be futzing with trying to shut off to work as a workstation. The same on a smaller scale applies to the vanilla server OS installs. That is why they are server operating systems and not client operating systems. It's all about the right tool for the right job, and not having a bunch of unnecessary tools on the system if you aren't using them.
Now rcolbert, you mentioned using the memsnap tool as some type of proof, but when challenged to explain an inconsistency you refused to do so. The thing is, I know exactly why memsnap showed the numbers it did for the example I asked you to describe (lsass), and that explanation goes further to describe what I mean by saying it uses no active resources. The memsnap tool is taking a poll of not just the service itself (which was paged even in your examople), but is also polling the shared files (almost unfailingly shared DLL files) that are not just being used by that process, but when it was first accessed by that process at startup it was associated with it under memsnap, despite it being tied to more than one running process. Remove the service it was associated with according to memsnap, and it is a pretty good guarantee that the shared libraries that numerous system services access will still grab it and consequently be associated with it by memsnap. Regardless, the original service (in this case, lsass) would still be completely paged and not polling the CPU or taking active memory space at all. Even the address location for it stored by the kernel would be paged if it has not been nor is directly being accessed (things like that are the parts of the kernel that get paged to begin with). That is how the kernel works. If you have an explanation of the processes by which memsnap is compiling the numbers that contradicts what I said, feel free to offer it up.
Once again, there is little or no reason to turn off any default Windows XP system service that is not already turned off. During installation, the services are set in a configuration that is most generally optimized for both startup and performance. This is not just an official Microsoft stance on it, this is testable and repeatable configuration that anyone themselves can try out. There are components that can be uninstalled or not installed to begin with, and if you (general you) are not going to use them then they shouldn't be there. Disabling is not the answer, and the question a person should ask themselves is "why is it installed to begin with?" For services like Wireless Zero Conf there are conditions where a manual setting isn't going to be a problem, but considering its innocuous and unobtrusive nature to begin with there are no performance issues and if no wireless device is connected the security issue is moot. If you're running IIS on a server, it's best to ask yourself why you're running it to begin with and remove it if it's not being used, not disabling the service itself.
This is why I take exception to your claims and have pretty much disregarded you as bullshitting: not because you're a total idiotyou seem to know enough to get by decentlybut because your very premise is flawed in that you are treating the symptoms instead of the cause. The number one reason Linux or BSD is hailed as being so great at security is because those who used it "back in the day" (more than five years ago) were already indoctrinated with the "if it ain't in use, why have it installed?" mentality. The same applies no matter what operating system you're running, which is why using the right tool for the job is more important than knowing how and where to run around shutting everything off. If you know what is installed and why, then the chances are that you will only have installed what you need to do the job anyway. This is the very reason why I suggest to those who want to game and don't just want to do it on a console to get XP Home Editionit already has less modules in it that you would otherwise have to go back and shut things off or uninstall things. This is why I would suggest Media Center Edition to someone who wants to use their PC for a video or audio center and don't just want an embedded receiver. This is why I suggest XP Pro for a domain workstation instead of Server 2003. It's all about using the right tool for the right job, and not trying to Swiss-Army-knife a solution from a single source. If you want to do that, then go ahead and download a *nix distro, re-work the kernel, and compile until your heart's content.
This isn't about me trying to pull some "gotcha!" or trying to press you to admit that you're wrong and I'm right. If your approach works for you then goody-good for you. Don't sell it as gospel, however: there are people who post here who actually work at Microsoft, know Microsoft's policies, and at least one of them has disagreed with you in this very thread. While I may not agree with everything Microsoft does as a software company, they have gotten the "right tool for the right job" mentality down pretty well now, and the options for how to improve system performance, security, and user experience are there. For every possible vulnerability, there are proper steps available to take. For 9.99 times out of ten, this has nothing to do with disabling services (even more if just talking about the client OSes).
Pointing out exceptions to the rule is not only simply point out the exceptions, but is trying to use that exception as if it were a loophole from which to apply poor practice as a common countermeasure for security.
- Status